BPI Letter on AML/CFT Safeguards in the Digital Asset Ecosystem

Ladies and Gentlemen:

The Bank Policy Institute^[1] is writing to express concern about the direction of anti-money laundering/countering the financing of terrorism modernization, which has left material gaps in illicit-finance coverage in the digital asset ecosystem. Historically, banks have played a key role in identifying suspicious activity and helping law enforcement to fight crime; they spend countless hours, resources and personnel to aid the government's national security aims. They deploy customer identification program requirements, know-your-customer requirements, transaction monitoring and suspicious activity reporting as vital parts of their AML/CFT regimes. Increasingly, fraud proceeds, funds obtained through sanctions evasion and terrorist finance and other illicit funds have moved from regulated exchanges to unhosted wallets, decentralized exchanges, liquidity pools, mixers, tumblers and cross-chain bridges, which have little to no AML/CFT oversight.

As exemplified most recently by the Oct. 29, 2026, North Korean hack of $6.36 billion from Binance,^[2] the largest cryptocurrency theft on record thus far, cryptocurrencies and stablecoins have become increasingly used by money launderers, criminals, terrorist financers and similar illicit actors. According to Chainalysis's 2026 Annual Report, illicit crypto addresses received $154 billion in 2025, a 162% increase year over year.^[3] But despite their recorded increase in use, digital asset intermediaries that help facilitate the use of cryptocurrencies by bad actors do not face the same legal obligations to protect the financial system as banks do. This is inconsistent with a basic AML/CFT principle: the same activity presenting the same risks merits the same regulation. Departure from that principle means those looking to launder money, finance terrorism or evade sanctions will seek out the least regulated option.

As the administration seeks to reform the Bank Secrecy Act, the U.S. Department of the Treasury must address the growing underlying risk in the digital asset ecosystem. Treasury, through FinCEN, should use its existing authorities to close the regulatory gaps in illicit finance coverage and impose obligations on digital asset intermediaries throughout the payment chain, particularly in the secondary market, where criminals can transfer cryptocurrencies without detection. FinCEN and OFAC's April 2026 notice of proposed rulemaking regarding the implementation of the Guiding and Establishing National Innovation for U.S. Stablecoins Act rightly distinguished between primary- and secondary-market payment stablecoin transactions, explaining that most illicit activity involving stablecoins occurs on the secondary market.^[4] But, while we support the historic strides made in payments innovation, we cannot support an emerging framework that fails to establish obligations or lowers existing ones where the risk is highest.

The Problem: Banks can't fill in all the information gaps in the digital-asset ecosystem

Banks play an essential, but limited, role in detecting illicit finance across the digital asset ecosystem. Their visibility is limited to fiat on- and off-ramps, and they lack a full view of transaction chains of cryptocurrencies. A bank may observe transfers to and from an exchange, but the bank will not have sufficient information to reconstruct the payment chain with any transactions involving self-hosted wallets, secondary market transactions, mixers or cross-chain bridges.^[5]

For example, Customer A could transfer $1,000 from a bank to a digital asset exchange, purchase cryptocurrency, transfer that crypto to a self-hosted wallet, route it through a mixer and ultimately return those funds through an exchange to the bank. While the regulated exchange has existing BSA obligations, unhosted wallets and mixers do not. The bank would see the initial and final fiat transfers but would have no way to determine what happened in between.

A bank's customer relationship with an exchange or stablecoin issuer does not, in itself, give that bank access to that exchange or issuer's complete customer records or subsequent transaction activity. These limitations leave banks with fragmented records rather than one continuous transaction history. And in turn, what they end up reporting under the BSA is subsequently incomplete and less useful to the federal government.

The U.S. national security apparatus faces an increasingly complex set of digital asset-enabled threats involving hostile nation-states, sanctions evaders, fraud and scam operators and criminal networks.^[6] Combating threats from Chinese money-laundering networks, North Korea and Iranian sanctions evasion networks requires a fuller picture of the illicit financial activity being perpetrated to harm U.S. national interests, instead of a patchwork of disconnected transactions. Blockchain analysis and financial institutions' BSA reporting can help authorities to reconstruct portions of that activity, but neither substitutes for reporting by intermediaries with direct access to relevant customer and transaction information. We should work toward developing the full picture, rather than reconstructing things piecemeal. Digital asset intermediaries should be subject to commensurate reporting obligations that reflect their risks and their unique access to information critical to law enforcement.

Withdrawal of FinCEN's proposals requires an alternative

An effective AML/CFT reporting regime must cover entities with visibility into illicit financial activity. However, FinCEN's withdrawal of three digital asset proposals raises questions about how Treasury intends to close these existing information gaps. The first, FinCEN's 2020 proposal, would have required banks and money service businesses to collect and retain information, verify customer identities and report certain transactions involving digital assets in unhosted wallets.^[7] The second, proposed in 2023, would have designated international convertible virtual currency mixing as a class of transactions of primary money laundering concern under Section 311 of the PATRIOT Act and imposed related reporting and recordkeeping requirements on covered financial institutions.^[8] FinCEN withdrew these proposals on Oct. 5, 2026, citing public comments and the Administration's deregulatory agenda.^[9] The third, announced on Nov. 6, 2026, would have lowered the cross-border Recordkeeping and Travel Rule thresholds from $3,000 to $250 and would have expressly covered transactions involving convertible virtual currency and digital assets with legal tender status.^[10]

While those proposals would have imposed obligations on banks and other entities with existing BSA obligations and not on digital asset intermediaries, the measures would have helped law enforcement gather information about persons transacting in digital currencies using unhosted wallets and interacting with mixers and therefore potentially help law enforcement identify illicit activity and actors. Treasury has not indicated that it intends to directly impose obligations on digital asset intermediaries to obtain the information the proposals were intended to capture as well as additional information that could assist law enforcement. Digital asset intermediaries hold relevant customer records, wallet information and transaction details unavailable to banks. Treasury should therefore assess what existing reporting provides, what additional information authorities need, which entities are best positioned to provide it and how to collect it most effectively. That assessment should guide a targeted approach that closes these material gaps. Given FinCEN's own recognition of the illicit finance risks in the digital asset ecosystem, it should expeditiously propose an updated framework that addresses illicit-finance risks and provides clear obligations for all actors in that ecosystem.

Recommendations

To establish a durable foundation for the healthy and responsible use of digital assets while addressing real and present risks in their growth, we lay out several recommendations.

• To address gaps in the regulatory framework, FinCEN and OFAC should ensure that all digital asset service providers, including those that custody, transfer, exchange or facilitate customer transactions, and persons operating or controlling decentralized finance arrangements, are designated as "financial institutions" under the BSA and subject to the full set of AML/CFT obligations commensurate with their activities and risks, and maintain the capabilities necessary to comply.^[11]

• Where existing authority is insufficient to close these gaps, Treasury should identify the specific gap and seek targeted legislative authority by working with Congress.

• Treasury should proactively address the limits on its authority to address mixers, tumblers and other obfuscating tools used to launder illicit proceeds, finance terrorism and evade sanctions, and it should work with Congress to secure targeted legislation to grant it clear authority to sanction mixers, tumblers and other blockchain applications that facilitate illicit finance.

• Treasury should play a convening role for law enforcement, financial institutions, stablecoin issuers, DASPs, blockchain analytics and other relevant players in the digital asset ecosystem to facilitate a whole-of-chain information-sharing approach to detecting illicit finance.

Closing

Responsible innovation and effective AML/CFT controls are compatible. But facilitating growth without requiring actors in the digital asset ecosystem to abide by robust AML/CFT and sanctions requirements is harmful to national security. Continuing to subject banks to intensive AML/CFT and sanctions regulation and examination while sophisticated illicit actors exploit gaps involving unhosted wallets, mixing services and other digital-asset exchanges undermines the effectiveness of the broader framework. The data is clear that criminals are already exploiting these gaps. The government's broader BSA modernization priorities should remove requirements that do not produce value, and should, in turn, impose requirements on participants best positioned to identify and report on illicit activity.

* * * * * * *

If you have any questions, please contact Paige Paridon at [email protected] and Clara Kim at [email protected].

Respectfully submitted,

Paige Paridon
EVP, Senior Associate General Counsel &
Co-Head of Regulatory Affairs
Bank Policy Institute

Clara Kim
SVP, BSA/AML & Sanctions
Bank Policy Institute

[1] The Bank Policy Institute is a nonpartisan public policy, research and advocacy group that represents universal banks, regional banks, and the major foreign banks doing business in the United States. BPI produces academic research and analysis on regulatory and monetary policy topics, analyzes and comments on proposed regulations, and represents the financial services industry with respect to cybersecurity, fraud, and other information security issues.

[2] TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, TRM Insights (Oct. 29, 2026), https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history.

[3] Chainalysis 2026 Crypto Crime Report at 7, The 2026 Crypto Crime Report

[4] Permitted Payment Stablecoin Issuer Anti-Money Laundering/Countering the Financing of Terrorism Program and Sanctions Compliance Program Requirements, 91 Fed. Reg. 18,582 (Apr. 10, 2026).

[5] Financial Action Task Force, Targeted Report on Stablecoins and Unhosted Wallets-Peer-to-Peer Transactions (Mar. 3, 2026) (discussing transactions conducted without a regulated intermediary and challenges associated with cross-chain activity); Financial Action Task Force, Targeted Report on Decentralised Finance (July 16, 2026) (identifying cross-chain bridges, decentralized exchanges, and mixers as techniques used to layer and commingle illicit funds); FinCEN, Advisory on Illicit Activity Involving Convertible Virtual Currency, FIN-2019-A003 (May 9, 2019) (explaining that mixing and tumbling can break the connection between sending and receiving addresses).

[6] FinCEN, Advisory on Illicit Activity Involving Convertible Virtual Currency, FIN-2019-A003 (May 9, 2019).

[7] FinCEN, Requirements for Certain Transactions Involving Convertible Virtual Currency or Digital Assets, 85 Fed. Reg. 83840 (Dec. 23, 2020).

[8] FinCEN, Proposal of Special Measure Regarding Convertible Virtual Currency Mixing, as a Class of Transactions of Primary Money Laundering Concern, proposed rule (Oct. 2023). Mixers, tumblers, cross-chain bridges and other tools are used by bad actors to obscure the source of funds. One way to limit financial institutions' exposure to this type of illicit conduct is to issue sanctions under the authorities exercised by OFAC to cut the target off from the financial system. But following a Fifth Circuit decision in 2024, Van Loon v. Dep't of Treasury, 122 F. 4th 539 (5th Cir. 2024). OFAC cannot sanction code - the immutable smart contracts on which mixers and tumblers often run - under IEEPA and cannot prevent unsuspecting consumers from interacting with these tools.

[9] FinCEN, FinCEN Announces Withdrawals of Proposed Digital Asset Related Rules (Oct. 5, 2026).

[10] FinCEN and Board of Governors of the Federal Reserve System, Threshold for the Requirement to Collect, Retain, and Transmit Information on Funds Transfers and Transmittals of Funds That Begin or End Outside the United States, and Clarification of the Requirement to Collect, Retain, and Transmit Information on Transactions Involving Convertible Virtual Currencies and Digital Assets with Legal Tender Status; Withdrawal, FR Doc. 2026-22809 (scheduled for publication Nov. 9, 2026).

[11] More generally, FinCEN should impose CDD and CIP requirements on all state money transmitters comparable to those required of banks.